Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2023 10:33
Static task
static1
Behavioral task
behavioral1
Sample
d92e6b60eecc9c96a1ad74e2d5c9ccba.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d92e6b60eecc9c96a1ad74e2d5c9ccba.exe
Resource
win10v2004-20231215-en
General
-
Target
d92e6b60eecc9c96a1ad74e2d5c9ccba.exe
-
Size
2.3MB
-
MD5
d92e6b60eecc9c96a1ad74e2d5c9ccba
-
SHA1
d7fcb40fa9a63dfaef531600da64c135d3079bd2
-
SHA256
8efce4180ae0e0f3c75dd2e13e44288c4352223f4b556c43bbb5cb96f8aec3ee
-
SHA512
ef9430611ea5b79108481cfa80961c569f0e2df82503afedff382f4f9bb0ed8227687a46b1c4e14af5692d81031b17c0c2bdb19bfac59cc59f3c3b099a332f37
-
SSDEEP
24576:FD+2lLAnMrJAmvGlBla8SmYU05za8oq9xKG+K/jAnKeL5qTZBHR1k85onek0nn15:FLuMNdGddGxsKrAEZZR1KneNBL2NuW
Malware Config
Signatures
-
Detect ZGRat V1 34 IoCs
Processes:
resource yara_rule behavioral2/memory/4768-7-0x0000000002DD0000-0x0000000002E48000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-11-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-21-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-43-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-67-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-71-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-69-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-65-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-63-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-61-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-59-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-57-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-55-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-53-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-51-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-49-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-47-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-45-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-41-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-39-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-37-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-35-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-33-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-31-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-29-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-27-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-25-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-23-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-19-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-17-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-15-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-13-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-9-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 behavioral2/memory/4768-8-0x0000000002DD0000-0x0000000002E42000-memory.dmp family_zgrat_v1 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exed92e6b60eecc9c96a1ad74e2d5c9ccba.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation d92e6b60eecc9c96a1ad74e2d5c9ccba.exe -
Executes dropped EXE 1 IoCs
Processes:
RegAsm.exepid process 1328 RegAsm.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
d92e6b60eecc9c96a1ad74e2d5c9ccba.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Users\\Admin\\AppData\\Roaming\\Programs\\Steam.exe\"" d92e6b60eecc9c96a1ad74e2d5c9ccba.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
RegAsm.exepid process 1328 RegAsm.exe 1328 RegAsm.exe 1328 RegAsm.exe 1328 RegAsm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
d92e6b60eecc9c96a1ad74e2d5c9ccba.exedescription pid process target process PID 4768 set thread context of 1328 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
d92e6b60eecc9c96a1ad74e2d5c9ccba.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000_Classes\Local Settings d92e6b60eecc9c96a1ad74e2d5c9ccba.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
d92e6b60eecc9c96a1ad74e2d5c9ccba.exepowershell.exepid process 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe 3872 powershell.exe 3872 powershell.exe 3872 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
d92e6b60eecc9c96a1ad74e2d5c9ccba.exepowershell.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe Token: SeDebugPrivilege 3872 powershell.exe Token: SeShutdownPrivilege 1328 RegAsm.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RegAsm.exepid process 1328 RegAsm.exe 1328 RegAsm.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
d92e6b60eecc9c96a1ad74e2d5c9ccba.exeWScript.exedescription pid process target process PID 4768 wrote to memory of 4864 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe WScript.exe PID 4768 wrote to memory of 4864 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe WScript.exe PID 4768 wrote to memory of 4864 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe WScript.exe PID 4768 wrote to memory of 1328 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe RegAsm.exe PID 4768 wrote to memory of 1328 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe RegAsm.exe PID 4768 wrote to memory of 1328 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe RegAsm.exe PID 4768 wrote to memory of 1328 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe RegAsm.exe PID 4768 wrote to memory of 1328 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe RegAsm.exe PID 4768 wrote to memory of 1328 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe RegAsm.exe PID 4768 wrote to memory of 1328 4768 d92e6b60eecc9c96a1ad74e2d5c9ccba.exe RegAsm.exe PID 4864 wrote to memory of 3872 4864 WScript.exe powershell.exe PID 4864 wrote to memory of 3872 4864 WScript.exe powershell.exe PID 4864 wrote to memory of 3872 4864 WScript.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d92e6b60eecc9c96a1ad74e2d5c9ccba.exe"C:\Users\Admin\AppData\Local\Temp\d92e6b60eecc9c96a1ad74e2d5c9ccba.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Rbtqvuqexxqqfvkdqsvr.vbs"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Programs\Steam.exe'3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1328
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1328-2289-0x0000000074D40000-0x0000000074D79000-memory.dmpFilesize
228KB
-
memory/1328-2306-0x00000000750E0000-0x0000000075119000-memory.dmpFilesize
228KB
-
memory/1328-2303-0x00000000750E0000-0x0000000075119000-memory.dmpFilesize
228KB
-
memory/1328-2300-0x00000000750E0000-0x0000000075119000-memory.dmpFilesize
228KB
-
memory/1328-2297-0x00000000750E0000-0x0000000075119000-memory.dmpFilesize
228KB
-
memory/3872-2273-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3872-2287-0x0000000074EB0000-0x0000000075660000-memory.dmpFilesize
7.7MB
-
memory/3872-2281-0x0000000007700000-0x000000000770E000-memory.dmpFilesize
56KB
-
memory/3872-2283-0x0000000007810000-0x000000000782A000-memory.dmpFilesize
104KB
-
memory/3872-2284-0x00000000077F0000-0x00000000077F8000-memory.dmpFilesize
32KB
-
memory/3872-2282-0x0000000007710000-0x0000000007724000-memory.dmpFilesize
80KB
-
memory/3872-2260-0x000000007EEE0000-0x000000007EEF0000-memory.dmpFilesize
64KB
-
memory/3872-2262-0x0000000070CF0000-0x0000000070D3C000-memory.dmpFilesize
304KB
-
memory/3872-2279-0x0000000007750000-0x00000000077E6000-memory.dmpFilesize
600KB
-
memory/3872-2280-0x00000000076D0000-0x00000000076E1000-memory.dmpFilesize
68KB
-
memory/3872-2272-0x00000000067B0000-0x00000000067CE000-memory.dmpFilesize
120KB
-
memory/3872-2244-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3872-2278-0x0000000007540000-0x000000000754A000-memory.dmpFilesize
40KB
-
memory/3872-2276-0x0000000007B10000-0x000000000818A000-memory.dmpFilesize
6.5MB
-
memory/3872-2277-0x00000000074D0000-0x00000000074EA000-memory.dmpFilesize
104KB
-
memory/3872-2274-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3872-2275-0x0000000007390000-0x0000000007433000-memory.dmpFilesize
652KB
-
memory/3872-2261-0x0000000006770000-0x00000000067A2000-memory.dmpFilesize
200KB
-
memory/3872-2241-0x0000000004B60000-0x0000000004B96000-memory.dmpFilesize
216KB
-
memory/3872-2242-0x0000000074EB0000-0x0000000075660000-memory.dmpFilesize
7.7MB
-
memory/3872-2259-0x0000000006250000-0x000000000629C000-memory.dmpFilesize
304KB
-
memory/3872-2258-0x00000000061A0000-0x00000000061BE000-memory.dmpFilesize
120KB
-
memory/3872-2243-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/3872-2257-0x0000000005CD0000-0x0000000006024000-memory.dmpFilesize
3.3MB
-
memory/3872-2246-0x0000000005990000-0x00000000059B2000-memory.dmpFilesize
136KB
-
memory/3872-2252-0x0000000005A40000-0x0000000005AA6000-memory.dmpFilesize
408KB
-
memory/3872-2245-0x00000000052B0000-0x00000000058D8000-memory.dmpFilesize
6.2MB
-
memory/4768-57-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-51-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-25-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-23-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-19-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-17-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-15-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-13-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-9-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-8-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-1117-0x0000000005720000-0x0000000005730000-memory.dmpFilesize
64KB
-
memory/4768-2222-0x0000000006850000-0x00000000068B6000-memory.dmpFilesize
408KB
-
memory/4768-2236-0x0000000074EF0000-0x00000000756A0000-memory.dmpFilesize
7.7MB
-
memory/4768-29-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-31-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-33-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-35-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-37-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-39-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-41-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-45-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-47-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-49-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-27-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-53-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-55-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-1-0x00000000008F0000-0x0000000000B4C000-memory.dmpFilesize
2.4MB
-
memory/4768-59-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-61-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-63-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-65-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-69-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-71-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-78-0x0000000074EF0000-0x00000000756A0000-memory.dmpFilesize
7.7MB
-
memory/4768-67-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-43-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-21-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-11-0x0000000002DD0000-0x0000000002E42000-memory.dmpFilesize
456KB
-
memory/4768-7-0x0000000002DD0000-0x0000000002E48000-memory.dmpFilesize
480KB
-
memory/4768-6-0x0000000006CC0000-0x0000000006E72000-memory.dmpFilesize
1.7MB
-
memory/4768-5-0x00000000056E0000-0x00000000056EA000-memory.dmpFilesize
40KB
-
memory/4768-4-0x0000000005720000-0x0000000005730000-memory.dmpFilesize
64KB
-
memory/4768-2-0x0000000005A30000-0x0000000005FD4000-memory.dmpFilesize
5.6MB
-
memory/4768-3-0x0000000005530000-0x00000000055C2000-memory.dmpFilesize
584KB
-
memory/4768-0-0x0000000074EF0000-0x00000000756A0000-memory.dmpFilesize
7.7MB